CVE-2026-70188

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A security feature bypass vulnerability (CVE-2026-70188) has been identified in ASP.NET Core's Kestrel web server, which accepts carriage-return and line-feed characters in HTTP/2 and HTTP/3 request trailers instead of rejecting the request as malformed. Microsoft's advisory also names header values read back from the HPACK dynamic table. HeroDevs investigation found that path is already validated in ASP.NET Core 6.0, so the .NET 6 impact is limited to request trailers.

Per CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), the weakness is a product that acts as an intermediary or endpoint and does not interpret malformed or ambiguous HTTP requests consistently with how other parties interpret them, letting an attacker smuggle a request past them.

This issue affects ASP.NET Core 6.0 applications that accept HTTP/2 or HTTP/3 requests through Kestrel, on Windows, Linux, and macOS. HTTP/1.1-only endpoints are not affected, and HTTP/3 is an opt-in preview feature in .NET 6. Microsoft's advisory lists ASP.NET Core 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.46 or earlier that accepts HTTP/2 or HTTP/3 requests through Kestrel.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.Server.Kestrel.Core
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This Critical-severity vulnerability is found in Kestrel's handling of HTTP/2 and HTTP/3 request trailers, the header fields a client may send after the request body.

HTTP/2 and HTTP/3 carry header fields as binary frames, so a header value cannot end a line the way it can in HTTP/1.1. The HTTP/2 specification therefore requires a server to treat any field value containing CR or LF as malformed. Kestrel checks ordinary request headers for these characters, but built trailer values with that check switched off. A request carrying CR or LF in a trailer was accepted, and the value reached the application unchanged. If the application, or a proxy built on Kestrel, later writes that value into an HTTP/1.1 message, the embedded line breaks can introduce header fields the sender was never allowed to set.

The fix turns the newline check on for trailer values, so Kestrel now rejects such requests as malformed, matching its handling of ordinary headers.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Aayush Atharva, as credited in Microsoft's advisory.